This build carries 17 dormant additions, most switched off behind hardcoded flags. Real-time PR webhook updates exist but are hardcoded off, so PR monitoring still polls every 30 minutes, and a new "thinking-binding-controls" beta header is compiled in but never sent. A Poll/Wait tool "evals" mode has nothing in this bundle that triggers it, and three placeholder tool entries are now always listed internally yet forced permanently off and hidden. Also inert: subagent output-truncation accounting behind the tengu_swift_whistle gate, a prefix-lock-rejection warning whose message text is always empty, an overage-included-models display with an empty-by-default model list, a "grant refused" safeguards error path whose trigger always returns false, a message-history folding pass held off by default behind tengu_chair_sermon, and MCP task-sidecar restore in --print mode, which is hard-gated off.
Of 80 shipped changes, several add configuration you can use right away. New settings bashOutputMaxChars and taskOutputMaxChars let you control how much Bash and Task output Claude sees inline before it spills to a file, and CLAUDE_STREAM_FIRST_BYTE_TIMEOUT_MS lets you tune how long Claude Code waits for the first byte of a streamed response. Cloud sessions running /mcp can now also list MCP servers attached to your local machine, and plugin marketplace add --claudeai lets you add a marketplace hosted on your claude.ai account. Other additions include an SDK --await-initialize flag to wait for plugin config over stdin, a CLAUDE_CODE_NONBLOCKING_STDOUT env var so slow output pipes can't hang the terminal, --append-subagent-system-prompt-file for the CLI, a configurable AWS Bedrock credential-resolution timeout, and an auto-mode dangerous-tool-use classifier, now expanded, that runs server-side and blocks unreachable checks for safety.
Among 35 fixes, failed background wake deliveries to agents now retry with backoff instead of dropping, and a cloud gateway 403 rejecting your org's settings no longer logs you out, showing a contact-admin message instead. Saving large tool results to disk is hardened against symlink and hardlink tampering, and the tool permission cache is now correctly keyed on GitHub repo and workspace-restriction state instead of serving stale results. Policy-limit data from before an account switch can no longer leak into the new account's session, and a newly org-approved synced plugin no longer stays silently disabled by a leftover local override. Separately, the keybindingFlavor setting is deprecated and classic word-editing keybindings are removed, so the prompt now always uses Bash-style word navigation.
Written by our agent from the shipped bundle, not by Anthropic.
You can now add a claude.ai-hosted plugin marketplace with a new --claudeai flag.
ExtensionsA new SDK CLI flag makes the process wait for an initialize request over stdin before starting.
ExtensionsNew settings let you control how much Bash and Task output Claude sees before it gets truncated to a file.
Settings & config
initialize requestSDK plugins can now be sent via an initialize request instead of the command line, with a fallback warning if not applied.
ExtensionsSDK gains get_usage and reload_output_styles requests for pulling usage data and refreshing styles mid-session.
Extensions<claude-code-hint> tag lets tool/command output suggest a plugin to installExtensionsWant the reasoning? Read walks the 30 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →Anything you can use today, anything that visibly changes, and anything worth poking at. One line each, open for detail.
<claude-code-hint> tag lets tool/command output suggest a plugin to install#Tool and command output can now embed a hidden tag that suggests installing a specific plugin.
You can now add a claude.ai-hosted plugin marketplace with a new --claudeai flag.
A bulk per-tool token counting path exists but is gated behind two flags, both off by default.
Remote Control session creation can use a new v1alpha2 API surface behind a flag.
Plugin marketplaces gain a new claude.ai-hosted source type with its own caching and refresh logic.
A background refresh for claude.ai plugin catalogs exists but is off by default.
Detailed prompt-cache-break diffing telemetry exists but is sampled at zero by default.
A new CCR v2 bridge CLI is gated behind a flag that currently defaults off.
A display for overage-included models exists but has an empty allowlist until set remotely.
The sandbox can now inject a Java proxy agent so JVM processes get network isolation too.
A new SDK CLI flag makes the process wait for an initialize request over stdin before starting.
New settings let you control how much Bash and Task output Claude sees before it gets truncated to a file.
initialize request#SDK plugins can now be sent via an initialize request instead of the command line, with a fallback warning if not applied.
SDK gains get_usage and reload_output_styles requests for pulling usage data and refreshing styles mid-session.
Plugin marketplaces can now be hosted on claude.ai itself, with full catalog fetching, caching and install support.
--resume can now adopt/accept custom (non-UUID) session IDs when used with SDK URL sessions#--resume can now accept custom, non-UUID session IDs for SDK URL sessions.
plugins field over stdin#The SDK's initialize request can now carry plugin paths over stdin instead of one flag per plugin.
Retrying a stalled API request now waits longer on the retry than on the first attempt.
Sandboxed Java processes now automatically route through the sandbox's proxy via an injected agent jar.
Stream-timeout errors now suggest raising API_TIMEOUT_MS or CLAUDE_STREAM_FIRST_BYTE_TIMEOUT_MS.
The SDK can now reload output styles mid-session with a new method.
A session setting for excluding dynamic sections now survives a worker restart in headless mode.
A new env var stops Claude Code from hanging when stdout is slow, like when piped somewhere.
A new flag lets you supply a subagent system-prompt append from a file instead of typing it inline.
GCP credential checks now distinguish timeout from failure and honor a new project env var fallback.
usage() call gains a skip_behaviors opt-out#The experimental usage() SDK call can now skip the 7-day behaviors scan for a faster response.
The get_usage command can now omit behavior data via a skip_behaviors flag.
AWS credential lookups now time out with a clearer error, and you can raise the timeout via an env var.
The CLAUDE_INTERNAL_FC_OVERRIDES env var no longer overrides feature flags.
The new Bash and Task output limit settings are now formally recognized and propagated internally.
What would fix it?
Smaller changes and internals, grouped as the pipeline found them. Nothing is dropped, it is only further down.
Hosts can now force gateway auth and routing through a policy check, independent of your env vars.
A new notice can appear if your claude.ai account identity changes mid-session.
Two new API beta headers, for dangerous tool use checks and thinking binding controls, are now sent by default.
Auto mode's dangerous-action classifier now runs server-side and blocks actions it flags or can't reach.
New diagnostics explain when org-managed hook restrictions or disabled settings are suppressing a synced plugin.
Running /mcp in a cloud session now also lists MCP servers attached to your local machine.
Plugins from claude.ai now get their downloaded archive verified against the install-time hash.
A new error clearly tells you to update Claude Code when your build is too old for a request.
claude.ai marketplace sync now separates installed, browse-only, and policy-blocked plugins.
The list of models included in overage usage can now refresh mid-session from remote config.
The SDK now warns if plugins sent via initialize weren't actually applied by the server.
copy_from action now honors deny/ask permission rules#Copying assets between artifacts now respects deny/ask permission rules, not just prior consent.
Artifact reads, diagnostics, and database reads now check per-URL deny/ask rules before falling back to session consent.
Auto-mode's 'action pending' message now explains the specific reason instead of a generic unavailable notice.
/doctor output now waits for organization policy limits to load before reporting them#/doctor now waits for org policy limits to load and shows an updating status line for them.
Diagnostics now explain in detail why org policy couldn't be fetched, with specific failure reasons.
Claude Code now fails fast with a clear /login message if admin policy requires gateway sign-in.
Disconnected bridge sessions now clearly show as 'offline' instead of a raw status string.
Custom Sonnet/Opus model picker labels now note when a model has a 1M-token context window.
Type-locked artifacts now block changing their contract or language when publishing.
A default design system now applies to every slide deck or visual design by default, with clear precedence rules.
The usage panel now distinguishes partial rate-limited data from fully unavailable data.
Claude now uses your marked default artifact automatically instead of asking, unless you said otherwise.
Blocked artifact network requests now explain clearly when the restriction is due to running remotely.
The initialize request now reports whether plugins you asked for actually loaded.
The skill-doctor unavailable message now explains exactly why it's off instead of just saying early access.
Bedrock token counting fallback now uses your own model instead of a Haiku probe.
Client IP resolution now reports the specific bad hop instead of silently falling back.
The 404 policy-endpoint error now names the request path and points you to claude doctor.
A blocked gateway now shows a specific 'contact your admin' message instead of a generic login error.
Remote Control diagnostics now show a distinct 'org policy not loaded' state.
Plugin cache-miss errors can now include more specific install-record context.
Diagnostics now show an 'Organization policy' status line alongside managed settings status.
A clearer error now tells you exactly how to fix a mismatched credential under gateway-mode org policy.
Plugin listings now flag entries not yet installable on claude.ai.
Remote Control now explains specifically when it's disabled due to missing org policy.
Failed claude.ai connector catalog fetches now retry automatically in the background.
A confirmed 404 on the policy route now shows a distinct 'policy route not served' message.
Remote Control now diagnoses when its policy route isn't being forwarded by a proxy or gateway.
Watch-artifact prompts now clarify Claude auto-replies to comments and won't re-ask to watch other artifacts.
Artifact comment auto-react can now be silently withheld by a rule, logged once per artifact.
Sessions now say when Claude Desktop is already watching a PR itself, and poll instead of using webhooks.
Updating a claude.ai plugin already at latest now skips reinstalling it.
Bash/PowerShell progress output now filters out noisy lines, not just long ones.
Policy-limits fetch failure logs now include which gateway host failed.
MCP server names are now redacted in toggle telemetry events.
get/add/remove) telemetry now hashes/obscures server names via Up#MCP CLI commands now hash server names in telemetry instead of sending them raw.
Local bash task output can now include a note about pending or incomplete output.
Custom slash-command names are now hidden from telemetry, replaced with 'custom'.
Artifact reply/resolve guard messages now state clearly that nothing was posted or read.
Resume now logs why a custom session ID was rejected before falling back to a fresh forked session.
Failed wake-ups to background agents are now retried with backoff instead of silently dropped.
Tool-result file writes are now hardened against symlink and hardlink tricks.
Sandbox write-path restore now skips symlinks that point outside the expected location.
The gateway server now denies requests with unparseable or unknown client IPs when access control is on.
Tool-result writes now refuse to traverse symlinked directories.
Available tools can now correctly differ by GitHub repo and workspace restriction state.
Broken claude.ai plugin installs now show specific errors instead of failing unclearly.
A blocked org gateway no longer logs you out; you now see a message to contact your admin instead.
A slow GCP credential check no longer forces an unnecessary refresh; it waits for an actual rejection.
Fixed stale layout when a container resizes after a percentage-based child was measured.
Policy-limits fetches that outlive an account switch are now discarded instead of misapplied.
Remote Control no longer reports a session as running to claude.ai when the local turn isn't actually live.
Artifact verify actions now re-check approval before proceeding, matching other read actions.
Fixed a race where tool permissions could be checked against a mid-update MCP config.
Newly-admitted synced plugins no longer get silently shadowed by a leftover local disable.
Publishing now blocks copy-sourced files that match a Read deny rule, not just the primary file.
Resuming a suspended terminal session now forces a resize check so layout stays correct.
Token counting now only falls back to gateway sampling on a specific HTTP 501 error.
Policy-limits fetch no longer fails outright when some compliance data is malformed.
mcp add-json#mcp add-json now validates server config against a schema before saving.
Reserved claudeai- prefixed marketplace names are now blocked during reconciliation too, not just on add.
Transcript rows pulled in via teleport no longer get re-uploaded to the remote store.
SSE MCP connections now consistently apply proxy and agent settings like other connection paths.
Permission-mode change status now reaches the UI even without an active remote-control bridge.
Failed policy-cache deletions are now logged instead of silently ignored.
Fixed a race where MCP client ownership could be lost during concurrent reconnects.
A reliability tweak fixes when the bridge reports 'running' status right after a turn result.
Each copied file in an artifact publish is now individually permission-checked.
Artifact comments now verify the read target hasn't changed before serving results.
Publishing now rejects a malformed files map upfront instead of proceeding partway.
A message-history folding pass stays off by default but now tracks which attachment types get folded.
A new SDK option lets plugins be delivered via the initialize request instead of argv, still opt-in.
Plumbing exists for a prefix-lock-rejection warning message, but it always renders as empty text.
Some poll-tool eval-tracking scaffolding exists but can't be reached in this build.
An 'evals' mode for the Poll/Wait tool exists but is hardcoded to never trigger.
Subagent report truncation accounting for a 'harness tail' section stays inert behind a flag.
PR webhook updates are hardcoded off; PR-monitoring sessions now always poll every 30 minutes instead.
A 'grant refused' safeguards error path exists but its triggering checks always return false.
An internal helper for directory git-sync is gated behind an env var whose purpose isn't stated.
Three inert stub tool placeholders are now unconditionally listed but forced off.
MCP task-sidecar restore in print mode is hard-gated off unconditionally.
An unnamed feature is permanently disabled and hidden in this build.
New internal state tracks restricted workspace roots and which settings sources apply within them.
Plugin resolution now distinguishes sync-attributed plugins and enforces managed hooks-only rules.
Skills and plugins gain a new claude.ai install source shown as claude.ai.
Chrome file uploads can now skip local prep under a Cowork-specific condition.
New internal diagnostics track the first message's shape to diagnose cache breaks.
Auto mode sessions now probe local git state and report telemetry about it.
Artifact publish now sends a new consent-holdback flag internally.
Bash/PowerShell output size limits are now computed dynamically instead of fixed.
Feature-flag resolution no longer falls back to disk cache once remote eval data has loaded.
Plugin manifests gain an id field required for claude.ai-sourced plugins.
A new system-prompt flag controls auto-mode context injection.
Disk session-cache adoption can now be suppressed internally after an account switch.
Remote sessions now report per-phase CPU usage split between CLI and tool subprocesses.
Auto-mode classifier context now trims progressively to stay within a byte budget.
A new provider-managed env var list decides gateway sign-in error wording.
MCP server config changes now trigger sync hooks to keep SDK hosts' binding state in sync.
Auto-mode permission classification now sends a richer context payload including git and Chrome state.
File-upload path safety checks were refactored into shared helpers reused across upload paths.
claude ultrareview gains a distinct "policy route missing" telemetry reason#ultrareview now reports a clearer reason when blocked by a missing policy route.
Internal logic now decides whether a plugin name is admitted or locked across marketplaces.
Cloud/attach sessions now recognize two more CLI flags for compatibility.
The macOS sandbox policy generator now groups rules to keep generated policies smaller.
Installed plugin records now track a claude.ai plugin id and archive hash.
New telemetry tracks stdout backpressure stalls and dropped bytes.
Session and teammate listings now carry an internal offline flag.
tengu_cozy_dusk#A new numeric remote-config gate was added with clamped bounds.
Plugin command failure telemetry now tags claude.ai-specific error codes.
New telemetry fires when auto-mode context is too large and gets withheld entirely.
Rate-limit tracking now records last-seen window data separately internally.
The command queue gained an internal subscription channel for removal events.
New sampled telemetry records detailed hashes around cache-prefix breaks.
Internal instructions now spell out how to tell genuine Slack user messages from bot-relayed ones.
New telemetry fires whenever a plugin install hint is shown to the user.
Telemetry auth-sending logic was tightened with an endpoint allowlist check.
TaskOutput's result size limit is now computed dynamically rather than fixed.
Telemetry schema now records how long a no-response stream timeout waited.
Policy-configured enabled plugins now track their marketplace explicitly instead of just a name.
Weekly usage-limit lookup logic was simplified and tightened.
New helpers detect claudeai-prefixed skill and plugin names.
A new feature gate was added, defaulting to false.
fallbackCause#Auto-mode fallback telemetry now records why a fallback model was used.
CLI debug output now reports which plugins were applied, like it already does for hooks.
IDE remote-control auto-enable status remains exposed via its experiment flag.
A new flag controls how poll and mid-turn event text is formatted.
A new flag affects relay routing when reading published artifact files.
Cancelling an async message now triggers an extra internal side-effect.
Hook plugin telemetry now resolves plugin id through a more robust lookup.
SDK session-result telemetry now includes the user message id being processed at session end.
The REPL bridge now can query whether a turn is currently live.
New telemetry tracks claude.ai marketplace catalog fetches and failures.
MCP server config updates can now short-circuit when nothing actually changed.
The system-reminder wrapper text is now built from shared constants instead of duplicated inline.
Word-boundary navigation logic was simplified, dropping a word-vs-punctuation distinction.
The keybindingFlavor setting is deprecated; prompt word-editing always follows readline conventions now.
Internal staging-domain support was dropped from artifact URL parsing.
The claude.ai URL resolver no longer points non-prod environments at a staging host.
Published verbatim by Anthropic for v2.1.261. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 67 bullets, 17 name something an entry on this page also names, 14 name something no entry here does, and 36 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
/status and claude doctor that says why your organization's policy could not be loaded, such as a proxy not passing the endpoint through
Probably policy-limits-404-error-message-rewritten, cli-debugstatus-payload-now-reports-which-plugins-were-appl, organization-policy-line-added-to-settings-source-status-l bashOutputMaxChars and taskOutputMaxChars settings to raise how much command and background-task output Claude receives inline before it is saved to a file, up to 128K characters
Probably taskoutput-tool-result-size-now-computed-dynamically, new-settings-for-inline-bashtask-output-truncation-limits, new-settings-keys-bashoutputmaxchars-taskoutputmaxchars --append-subagent-system-prompt-file to read the subagent system prompt from a file, for prompts too large to pass on the command line
Probably new-cli-flag-append-subagent-system-prompt-file /skill-doctor to show which loaded skills go unused and what they cost in context, so you can prune them
Probably skill-doctor-availability-text-now-explains-rollout-mechanic /add-dir <subdirectory> printing a false "couldn't be resolved" error when the working directory is on a /net automount
No entry names this enabledPlugins, then falling back to a marketplace clone that could fail
Probably marketplace-scoped-enabledplugins-now-records-marketplace-ex [Image #N] chip in the prompt input
No entry names this /clear
No entry names this /teleport into the connected session, which appeared appended to the original on phone and web
Probably remote-controlsession-persistence-skips-uploading-rows-from gcpAuthRefresh opening a browser at startup when the Google credential check was slow, even though the credential was still valid
Probably gcp-credential-check-becomes-tri-state-and-honors-anthropic /usage and the VS Code usage panel dropping a model-specific weekly limit row when the usage endpoint is rate limited or when opened right after startup
Probably two-new-sdk-control-protocol-request-types-get-usage-and-re claude -p --resume <file> adopting a malformed session ID recorded in the transcript; it now resumes under a fresh session ID instead
Probably resume-can-now-adoptaccept-custom-non-uuid-session-id X-Forwarded-For; with an access list set, an unreadable entry now gets 403
Probably trusted-proxy-client-ip-resolution-now-reports-bad-hops, gateway-proxy-hardens-x-forwarded-for-handling file_upload failing with "paths: expected array, received undefined" in local Cowork sessions run from the Claude Desktop app
Probably claude-in-chrome-file-uploads-bypass-local-preparation-under, chrome-extension-file-upload-path-validation-hardened-and-re SendMessage to an offline Remote Control session on another machine reading as delivered; the result now says delivery is queued until that machine reconnects
Probably subagent-harness-tail-size-accounting-behind-tengu-swift-w <claude-code-hint> tag no longer leaks into the conversation
Probably claude-code-hint-plugin-references-now-validated-as-name-at-mar, new-tag-lets-toolcommand-output-suggest-a-plugin-to-inst /model picker and the VS Code model pill to show a model's name instead of its raw Bedrock, Vertex AI, or LLM gateway ID when Claude Code recognizes it
No entry names this GOOGLE_APPLICATION_CREDENTIALS is set: API client creation no longer re-runs Google Cloud project discovery or spawns extra gcloud processes
No entry names this rm safety prompt to also catch rm -rf on positional parameters and inside double-quoted sh -c scripts
No entry names this API_TIMEOUT_MS (10 minutes by default) instead of another 3 minutes, and the messages say what to change
Probably more-detailed-stream-timeout-error-message-with-tunable-env /login) to say Claude Code may not be enabled for the organization, instead of advising a new sign-in
Probably clearer-managed-settings-error-when-org-requires-cloud-gatew, new-provider-managed-env-var-list-for-gateway-policy-checks, managed-policy-enforcement-of-cloud-gateway-sign-in forceLoginMethod: "gateway" to ignore a leftover API key or claude.ai login and ask for /login; Bedrock, Vertex AI, and Foundry sessions are unaffected
Probably clearer-managed-settings-error-when-org-requires-cloud-gatew, new-provider-managed-env-var-list-for-gateway-policy-checks, managed-policy-enforcement-of-cloud-gateway-sign-in keybindingFlavor no longer has any effect
Probably keybindingflavor-setting-deprecated-classic-word-editing-mo /context token counting to use a local estimate when the token-counting API is unavailable, instead of extra small-model requests
No entry names this /btw side-question history from earlier sessions being overwritten when a question is asked right after a window reload or while a settings file has errors
No entry names this No change to the system prompt since v2.1.260.
Claude Code, interactive mode
318 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
Every time above is when this site's poller recorded the change, which is up to half an hour after the edit on an ordinary read and up to a day after it on a full sweep. Upstream's own edit time is used instead wherever a capture carries one. None of these do.
The 74 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?